42
42
42
47
42
60
60
42
60
30
O-CMS 1.0.0 Authenticated OS Command Injection via ai_cli_script
O-CMS 1.0.0 has an authenticated OS command injection in the ai_cli_script parameter, letting privileged attackers execute arbitrary commands.
O-CMS version 1.0.0 contains an authenticated OS command injection vulnerability in its AI CLI configuration functionality. An authenticated attacker with sufficient privileges can supply shell metacharacters and extra commands through the ai_cli_script parameter of /admin/settings/save. The attacker-controlled CLI value is then executed when the configured AI provider is tested via /admin/settings/test-ai.
22
Flextype v1.0.0-alpha.3 CMS registerShortcodes() Remote Code Execution via Attacker-Controlled File Inclusion
Flextype CMS v1.0.0-alpha.3 allows PHP remote code execution via path traversal in the Entries API combined with shortcode file inclusion.
Flextype CMS v1.0.0-alpha.3 exposes a remote code execution path through the interaction of the Entries API and Shortcodes::registerShortcodes(). The /api/v1/entries endpoint accepts attacker-controlled entry identifiers containing path traversal sequences, allowing PHP-containing content to be written outside the intended entries directory. A subsequent attacker-controlled path can then be included and executed as PHP. Ron E posted the disclosure to the Full Disclosure mailing list on September 3, 2026.
34
60
47
60
30
60
60
47
60
30
55
New malicious web shell from the Tropic Trooper group is found in the Middle East
60
60
60
60
60
47
55
60
30
60
30
60
55
30
60
35
42
42